mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2026-09-09 00:06:08 +08:00
Sander van Deijck
c84523a6b6
Release notes: https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.2-stable This is a security release fixing 32 CVEs (6 High, 15 Med, 11 Low). Many of them apply to the configuration built here: --enable-opensslall and --enable-opensslextra are unconditional, and TLS 1.3, session tickets and OCSP stapling default to y. Fixes CVEs: - CVE-2026-11310 (High) - CVE-2026-11999 (High) - CVE-2026-6679 (High) - CVE-2026-55958 (High) - CVE-2026-55960 (High) - CVE-2026-55961 (High) - CVE-2026-6731 (Med) - CVE-2026-6091 (Med) - CVE-2026-6094 (Med) - CVE-2026-6329 (Med) - CVE-2026-6330 (Med) - CVE-2026-8720 (Med) - CVE-2026-10097 (Med) - CVE-2026-10098 (Med) - CVE-2026-10592 (Med) - CVE-2026-7532 (Med) - CVE-2026-6291 (Med) - CVE-2026-7511 (Med) - CVE-2026-11703 (Med) - CVE-2026-55962 (Med) - CVE-2026-55964 (Med) - CVE-2026-6092 (Low) - CVE-2026-6331 (Low) - CVE-2026-6681 (Low) - CVE-2026-10512 (Low) - CVE-2026-6678 (Low) - CVE-2026-7531 (Low) - CVE-2026-6325 (Low) - CVE-2026-6412 (Low) - CVE-2026-6450 (Low) - CVE-2026-12340 (Low) - CVE-2026-55967 (Low) OCSP responder authorization is now strictly enforced per RFC 6960 4.2.2.2. The CheckOcspResponderChain() fallback, which accepted any responder certificate issued by an ancestor of the target's issuer, was removed. Setups relying on an indirectly issued OCSP responder will start to fail validation. Refreshed patches. Signed-off-by: Sander van Deijck <sander@vandeijck.com> Link: https://github.com/openwrt/openwrt/pull/24700 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>